Tag Archives: LinkedIn

The good folks at Exterro recently released a very interesting report titled “Federal Judges Survey, eDiscovery Best Practices and Trends.” The title includes a link to download the report, which I highly recommend reading as it is good to know what the judges who rule on eDiscovery all the time are thinking. Overall, the report calls for some necessary disruptive change in the practice of eDiscovery in order to demonstrate competency. There are some excellent tips in the report on how eDiscovery professionals can improve and what kinds of trends we should be on the lookout for.

One finding stood out to me in particular – the Judges surveyed felt that social media would be the technology trend with the biggest effect on eDiscovery over the next two years.

It is no coincidence that X1’s Social Discovery product continues its rapid upward trajectory. There is simply no other product on the market that offers a true investigative platform for this critical new data type. Such a social media investigative platform will include:

Tight API connections to the major social media publishers like Facebook, LinkedIn, Twitter, and Instagram. The API connection allows for the capture of unique metadata that each publisher adds to its data.

A web crawler and capture capability that creates a copy of the page to be stored for processing into a preservation repository.

The ability to keep data forensically sound. This requires calculating MD5 hash values of individual items upon capture and maintaining those values through export. The platform must keeps logs and reports of all actions on data. It also must be able to use metadata to establish chain of custody and authentication.

The challenge with social media – unlike email – is that much of the data resides outside the walls of an organization. Collection of social media becomes a challenge. Companies cannot simply call Facebook or Twitter and request all of the information for various custodians. It is possible to take screenshots of various web pages or social media sites, but as case law points out, screenshots are not necessarily admissible as evidence. Plus, screenshots take a technical toll on eDiscovery – they can be difficult to index and may require OCR, which still may not be able to pull text out of the image. That is where aninvestigative platform like X1 Social Discovery is so important to a competent eDiscovery practice.

This week’s blog is something new for X1 – a Q & A with Howard Williamson, the General Manager for X1’s market leading Social Discovery product. Howard is an experienced digital forensics expert and began his career in law enforcement, which gives him a unique perspective on the practice of social discovery. I had the pleasure of interviewing Howard this week on what is a very hot topic – social discovery.

Why Social Discovery?

Howard: I remember back in the mid-1990’s there was a real feeling of excitement around digital forensics. It was the cutting edge of the forensics field and the work was really fun. Social media is now what digital forensics was in the mid to late 1990s – it’s the cutting edge of where investigation and intelligence is right now. The work is fun because there are lots of challenges; the fun part is taking the practice from good to great. That is what attracted me to the opportunity at X1 – because X1 Social Discovery can make the practice great because the product addresses the challenges of defensibly collecting a high volume, diverse data set like social media.

How does the law enforcement background complement this role?

Howard: Ultimately, the goal of social discovery is to collect data in a manner that allows it to be used in criminal or civil litigation. Knowing how that process works is critical. The law enforcement background gives that experience of defensible collection across many different types of digital evidence. And, on the criminal side of things, the standards of defensibility are quite high, so carrying that over to the civil side means that X1 will always meet high authenticity standards. I bring that high bar from the digital forensics world to this brave new world of social media.

What’s new about this practice?
Howard: The nice thing about now versus the mid-1990s is that we are now using purpose-built tools like X1 Social Discovery rather than co-opting system administration and network tools like we did in the early days of computer forensics. That makes the process more efficient and more complete.
Rather than using a sledgehammer to put a nail in, we are using a hammer. The tool is built specifically for social discovery and therefore makes the practice more efficient. Whereas in the early days of digital forensics, collection procedures where often made up on the fly, with Social Discovery, the approach is much more structured and systematic. At X1, with our experience, we are certainly able to think and react on the fly to new challenges, but with a purpose-built tool, we can do so much more efficiently. And, in the eDiscovery world, efficiency and defensibility are two very important things.

Are you seeing social discovery specialists pop up?

Howard: What we are seeing is that digital forensics professionals and intelligence professionals are implementing social discovery into their processes and procedures. There are not “specialists” in social media; rather, the social discovery tool allows more people to collect this type of data as part of a broader job. They are also doing things like mobile forensics and other digital forensics. Thus, X1 Social Discovery has become an important tool in their toolkit. The tool actually makes it easier to bring social media content into the collection because the professional doesn’t have to dive deep into things like mobile operating systems. It becomes easier to be an expert in social collection because the product makes it simple to collect and analyze.

Do you think that Social discovery is a mainstream practice now?

Howard: It absolutely is. The evidence of that is our business. X1 has nearly500 paid install sites and nearly 4,000 end users conducting social discovery. These users got ahead of the curve and have social media integrated into their processes. The growth opportunity is still huge because it is inevitable that case law will force everyone to take social media more seriously, in the way that the Enron case put a spotlight on electronic discovery in general. Law enforcement got the importance of social media evidence early on. Even though a more typically cautious industry, police departments see that social media is a critical form of evidence and have built it into collection processes. This is how most areas of forensics have evolved. There is an attitude that, if it’s good enough for criminal law, it’s good enough for civil court. That is part of what’s exciting for X1 – we have a great base of law enforcement customers putting the product through the paces. X1 Social Discovery is truly battle-tested and no other solution works quite as well. We are nicely positioned as the social discovery leader in a mainstream market with high growth potential.

What should we look for in the next year of social discovery?

Howard: I would expect to see the big social networks continue to gain traction. I don’t foresee a new behemoth social network to challenge the popularity of Facebook and Twitter. From an app perspective, self-destructing messaging looks to remain popular as privacy becomes more of a concern. Forensics will play a large role in determining whether those messages are truly destroyed or actually discoverable.

X1 will continue to build out connectors to more and more social networks and improve reporting and deliverables. There will be more ability to analyze the data within the investigation platform. What X1 wants to enable is people to do their jobs within a given workflow. Some users will want to collect and review social media directly within X1, and the tools enables them to do that. Others have examiners collect the data, but then move to a review tool where litigators can look at it.

Big thanks to Howard Williamson for sharing his time with us. If you have questions about social discovery, please contact us at info@x1.com for more information.

Social media is now a very public extension of an individual’s life. Its widespread appeal and ease of use has given rise to new digital profiles that share extensive and mostly publically available information. However, despite being a treasure trove of potentially relevant information, social media is often overlooked in litigation.

In my practice — involving matters performed on behalf of law firms and law enforcement agencies — social media is, more often than not, a crucial stone to upturn for key evidence, and in many cases proves to be the “smoking gun”. In fact, social media evidence is relevant and important over 70 percent of the cases we handle. And thanks to the public nature of social media evidence and the automation and scalability of X1 Social Discovery, we are able to proactively collect social media evidence in our cases, which has been a game-changer in several instances.

For instance, I recently received a call from the local sheriff’s office regarding a series of threatening Twitter and Facebook posts being made against public figures. The mentally ill man responsible for the posts included updates and photos from his visits to the pubic figures’ homes. The up-to-the-minute captures we obtained with X1 Social Discovery gave law enforcement the opportunity to catch up with the suspect before he was able to elevate his threats and/or delete his threatening posts. Furthermore, X1 Social Discovery’s collections are easily delivered to the necessary parties in a timely manner, which allowed law enforcement to charge the man with terroristic threats and stalking.

Social media is also extremely valuable for eDiscovery investigations in civil cases. For example, in a recent intellectual property theft suit, I used X1 to collect the publicly available LinkedIn profile of a disgruntled employee, who left her company for a competitor. The woman’s LinkedIn profile disclosed that she began her tenure with the competitor nearly three months before she officially quit. Using the date provided, I was able to determine that same week she copied thousands of confidential electronic records to a USB thumb drive from her work-issued laptop. The evidence collected by X1 Social Discovery proved to be extremely valuable, and when used in conjunction with other evidence, a settlement was reached in a matter of hours after the analysis results were produced. In this way, social media provides important context to other aspects of discovery.

In fact, it is now a routine practice for us to proactively preserve social media evidence, even if not explicitly requested by our clients. Earlier this year, I was working on a civil case and, immediately upon being retained, collected the opposing party’s public Facebook and Twitter profiles using X1 Social Discovery. A few weeks later, I brought to the attention of my client the fact that this person’s Facebook and Twitter accounts had been deleted shortly after the Court had entered a preservation order. Thankfully, we had collected these accounts ahead of time; which contained relevant information, including incriminating posts that weakened her case. The matter was settled within a week.

Often, lawyers are uncomfortable about social media collections given its newness and bad experiences when relying on screen captures. It’s true that social media collections can present unique challenges when best practices are not utilized. But as it is now essential to nearly all digital investigations, I am always sure to advise my clients about collecting it, something that would otherwise be very burdensome and would not scale without X1 Social Discovery. With the ever-changing nature of computer forensic investigations and e-discovery, it is important for attorneys and investigators to keep an open mind, as well as stay current on social media’s growing capabilities, which are expanding goldmines for potentially relevant information. Once litigation has started, it is important to preserve everything that could be deemed relevant. With the ease of access afforded to users and the semi-volatile nature of social media data, X1 allows for an efficient and admissible collection method.

In fact, usage of social media for business is growing and it will soon catch up to (and probably surpass) email. We all know what happened with discovery of email – the inability to efficiently collect it practically created the eDiscovery industry. Reinforcing the fact that social discovery has arrived are the sales numbers for X1’s social discovery product – which continue to grow exponentially – and word from service providers that they are doing Facebook collections thirty times per week. I believe that social discovery is poised to become a big market in and of itself.

The challenge with social media – unlike email – is that much of the data resides outside the walls of an organization. Collection of social media becomes a challenge. Companies cannot simply call Facebook or Twitter and request all of the information for various custodians. It is possible to take screenshots of various web pages or social media sits, but as John’s blog points out, screenshots are not necessarily admissible as evidence. Plus, screenshots take a technical toll on eDiscovery – they can be difficult to index and may require OCR, which still may not be able to pull text out of the image. Companies could write API connections to the social media publishers themselves, but that requires a ton of labor to not only build those connectors, but also to manage the almost weekly updates to the publishers’ APIs. Instead, companies should look for an investigative platform.

A social media investigative platform will include:

Tight API connections to the major social media publishers like Facebook, LinkedIn, Twitter, and Instagram. The API connection allows for the capture of unique metadata that each publisher adds to its data.

A web crawler and capture capability that creates a copy of the page to be stored for processing into a preservation repository.

The ability to keep data forensically sound. This requires calculating MD5 hash values of individual items upon capture and maintaining those values through export. The platform must keep logs and reports of all actions on data. It also must be able to use metadata to establish chain of custody and authentication.

One of the points eDJ Group makes in its “Collection of Preservation of Social Media” report is to “[p]lan for more and more social media. While companies can focus near-term efforts on the major publishers (Facebook, LinkedIn, Twitter), over time there will be more and more sources of social media for companies to govern. The number of users of other social networks like Google+ and Tumblr continues to increase. More and more companies share video content via YouTube. And, just imagine the rich evidence that a site like FourSquare (which allows users to check in with their geographic location) could provide.” Social discovery is here to stay and the stakes are getting higher. The time to act and build the capability is now, not a year from now when you are already behind the eight-ball – that will only create the same situation we created by getting behind the curve with email.

As part of our ongoing effort to monitor legal developments concerning social media evidence, we again searched online legal databases of state and federal court decisions across the United States — this time to identify the number of cases in the first half of 2012 where evidence from social networking sites played a significant role. The results are available here in a detailed spreadsheet listing each case, allowing for anyone to review the cases and conduct their own analysis. The cases are accessible for free on Google Scholar. The overall tally come in at 319 cases for this 6 month period, which is about an 85 percent increase in the number of published social media cases over the same period in 2011, as reported by our prior survey earlier this year.

As with the last survey, we reviewed all the search results and added annotations for the more notable cases, and were sure to eliminate duplicates and to not count de minimis entries — defined as cases with merely cursory or passing mentions of social media sites. As only a very small number of cases–approximately one percent of all filed cases– involve a published decision that we can access online, it is safe to assume that several thousand, if not tens of thousands more cases involved social media evidence during this time period. Additionally, many of these published decisions involve fact patterns from as far back as 2008, as they are now just working their way through the appeals process. Finally, these cases do not reflect the presumably many thousands of more instances where social media evidence was relevant to an internal investigation or compliance audit, yet did not evolve into actual litigation. Even so, this limited survey is an important data point establishing the ubiquitous nature of social media evidence, its escalating importance and the necessity of best practices technology to search and collect this data for litigation and compliance requirements.

The search, limited to the top four social networking sites, tallied as follows: Facebook is now far in the lead with 197 cases, MySpace tallied in at 89, mostly with fact patterns circa 2009, Twitter with 25 and LinkedIn with 8. Criminal matters marked the most common category of cases involving social media evidence, followed by employment related litigation, insurance claims/personal injury, family law and general business litigation (trademark infringement/libel/unfair competition). One interesting and increasingly common theme involved social media usage being considered as a factor in establishing minimum contacts for jurisdictional purposes. (SeeJuniper Networks, Inc. v. JUNIPER MEDIA, LLC, and Lyons v. RIENZI & SONS, INC, as examples)

We plan on providing a complete summary for all of the 2012 cases in early January and it safe to assume that the second half of 2012 will continue to see a sharp increase in the presence of social media evidence.